lookout triage logs

kubectl logs, distilled: Drain-clusters raw lines into templates with counts (probe noise stripped, stack traces collapsed to top frames) — reach for this instead of reading logs whole.

MCP tool: k8s_triage_logs (MCP profile: triage)

Usage

lookout triage logs [flags]

Flags

Flag	Type	Default	Meaning
--pod	string	—	read one pod by name (requires —namespace)
--container	string	—	restrict to one container (default: all init + regular + ephemeral containers)
--previous	bool	—	read the previous container instance (what a crashed container said before it died)
--tail	int	5000	max lines fetched per container stream (0 = no limit)
--max-templates	int	40	cap emitted template clusters; the low-count tail is summarized in one log.overflow finding
--keep-probes	bool	—	keep health/readiness probe request lines instead of stripping them

Common flags (every lookout command)

Flag	Type	Default	Meaning
--namespace	string	—	limit the scan to one namespace
-A	bool	—	scan all namespaces
--workload	string	—	target one workload as <Kind>/<namespace>/<name>, e.g. Deployment/prod/api
--since	duration	—	how far back to look (0 = command default)
--format	string	logfmt	output format: logfmt|json (one record per line either way)
--timeout	duration	10s	abort the invocation after this long (exit 1)
--kubeconfig	string	—	path to a kubeconfig file, instead of $KUBECONFIG / ~/.kube/config
--context	string	—	kubeconfig context to read, instead of its current-context. Selects a cluster for THIS invocation only — nothing is written back — so concurrent invocations can target different clusters. Reported as context=<name> in the summary line
--exemptions	string	—	path to a git-reviewed exemption file (YAML); covered findings are ANNOTATED with their reason and expiry and counted as exempt=<n> in the summary, never dropped

Finding kinds

Every kind= this command can emit, and the severities it carries them at. Nothing else appears in its output; a kind absent from a run means the check looked and found nothing. See the finding-kind glossary for the whole vocabulary.

Kind	Severity	Claim
log.template	critical, warning, info	one distilled template and how many lines collapsed into it; severity is the guessed level — critical at fatal, warning for error-ish, info otherwise
log.stacktrace	critical, warning, info	a template that is a Go panic, Java exception, or Python traceback, with its innermost frames
log.overflow	info	the low-count tail —max-templates dropped, counted rather than discarded silently (no coverage lies)
log.probe_noise	info	health/readiness probe request lines stripped before distillation, counted so the removal is visible
log.fetch_error	warning	a container’s log stream could not be read, so its lines are missing from the distillation

Output fields

Beyond the shared envelope fields (kind, severity, namespace, kind_of_object, name, reason, message, fingerprint, exempt_reason, exempt_expires):

Field	Meaning
template	log template; <*> marks positions that varied across merged lines
count	lines merged into this cluster (on log.probe_noise: probe lines stripped)
pods	distinct pods that emitted this template (present when >1)
level	guessed log level (fatal|error|warn|info|debug) from token/field match
first_seen	RFC3339 timestamp of the oldest merged line (from log timestamps when parseable)
last_seen	RFC3339 timestamp of the newest merged line
lang	stack-trace runtime on log.stacktrace findings: go|java|python
frames	top stack frames on log.stacktrace findings, innermost first, ’ < ’ separated
sample	one representative raw line, truncated and sanitized
container	container the finding refers to (log.fetch_error only)
omitted_templates	clusters dropped by —max-templates (log.overflow only)
omitted_lines	lines inside the dropped clusters (log.overflow only)

Output contract

Output: one finding per line (logfmt; —format=json for one JSON object per line), keys in fixed order; healthy resources emit nothing. The final line is always the summary: scanned= findings= elapsed= — findings=0 with a summary present means “scanned and healthy”; a stream without a summary line is void. Exit 0 data, 1 runtime error (diagnostics on stderr only), 2 usage.

Examples

lookout triage logs --workload=Deployment/prod/api --since=30m
lookout triage logs --namespace=payments --previous --container=app
lookout triage logs --pod=api-6d5f9c7b4-xk2p1 --namespace=prod --format=json